Developers Can Make Coding Agents Wait 7 Days Before Installing New Packages

·4 views

Supply-chain attacks on npm packages often remain live for only hours, so a freshly published malicious version can be pulled by a coding agent before anyone reviews it. The article recommends a release-age gate, or cooldown, that refuses package versions younger than a set number of days. Package managers npm, pnpm, Yarn, Bun and uv each support such a setting, but they use different keys and units, so a wrong unit can make the gate ineffective or absurdly long. The npm setting requires version 11.10.0 or later, and older versions silently ignore it, so developers should verify their installed version. Developers can also exempt packages from the gate, though only for scopes they control on the public registry.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Three Tauri build bugs found after a green CI run on macOS, Windows and Linux

The author maintains StackerPulse, a Rust and Tauri v2 desktop app, and shipped builds across three platforms from one workflow. A macOS universal build failed at bundling because a second binary, a CLI secret scanner, was compiled but never merged into the universal output, even though each individual step behaved correctly. A release workflow then reported success while uploading no installers, since the release-creation step returned an empty ID and the action skipped uploads without any warning. Inspecting the update manifest revealed a third issue: two per-language MSI installers shared one architecture key, so the English build was overwritten and users could receive the wrong language after an update. The author concludes that a passing build only shows the toolchain did not crash, and that these failures emerge from handoffs between components.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SteamVR verbessert Streaming-Bildqualität, doch Sehtraining erfordert andere Ansätze

Valve hat ein SteamVR-Beta-Update veröffentlicht, das die Bildqualität beim Streaming über Steam Link auf Standalone-Headsets wie Meta Quest, HTC Vive Focus und PICO verbessern soll. Der Artikel betont, dass schärfere Bilder nicht zwingend die Verarbeitung im visuellen System verbessern, da bei Amblyopie und Aufmerksamkeitsdefiziten vor allem die Gewichtung der Augensignale im Gehirn entscheidend ist. Deshalb eignen sich VR-Headsets mit zwei unabhängigen Bildfeeds für dichoptisches Training, bei dem beide Augen gleichzeitig unterschiedliche Bilder erhalten. Die App Amblyotube für Meta Quest nutzt dieses Prinzip, indem sie ein Seh- und Aufmerksamkeitstraining in YouTube-Inhalte einbettet. Der Artikel beschreibt außerdem Kalibrierung, einen Sehtest und Filter, die das dominante Auge gezielt beeinflussen.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Axelor Permission Reviews Urged Across Objects, Fields, and Roles

A security write-up argues that Axelor Open Suite, a low-code platform spanning CRM, finance, inventory, HR and other modules, needs its permissions audited as a whole. It notes that effective access comes from combining object permissions, field-level rules, record conditions, and layered roles and groups. The author highlights export rights, integration service accounts, and attachment routes as areas where data can leak despite restricted records. Recommendations include restricting admin and customization menus, alerting on role and permission changes, and testing workflows in a low-sensitivity staging environment. The piece also reports ZoomEye search counts for Axelor-titled instances as a candidate population, while cautioning that those results do not establish how many are actually affected.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Student's Midnight AI-Pasted Homework Backfires in Class Group Chat

A naval architecture student in Bangladesh pasted an AI-generated answer to a problem set into his class group chat late at night, just before the deadline. The solution was correct, but a classmate asked him to explain one conversion step, which he could not do. He pretended to check the work and felt the moment pass without understanding the material. The student says the episode taught him that a copied answer does not meet the purpose of the assignment. He draws a line: if he cannot explain a submitted answer, it is not his work, regardless of which tool produced it.

0 comments Read more at DEV Community